properly HTML escape headers